#2016 Fix a crash in function call when the **kwargs dictionary is mutated
during the function call setup.
This even gives a slight speedup, probably because tuple allocation
is faster than PyMem_NEW.
diff --git a/Lib/test/test_extcall.py b/Lib/test/test_extcall.py
index f4ab204..a10887e 100644
--- a/Lib/test/test_extcall.py
+++ b/Lib/test/test_extcall.py
@@ -251,6 +251,24 @@
...
TypeError: id() takes no keyword arguments
+A corner case of keyword dictionary items being deleted during
+the function call setup. See <http://bugs.python.org/issue2016>.
+
+ >>> class Name(str):
+ ... def __eq__(self, other):
+ ... try:
+ ... del x[self]
+ ... except KeyError:
+ ... pass
+ ... return str.__eq__(self, other)
+ ... def __hash__(self):
+ ... return str.__hash__(self)
+
+ >>> x = {Name("a"):1, Name("b"):2}
+ >>> def f(a, b):
+ ... print a,b
+ >>> f(**x)
+ 1 2
"""
import unittest
diff --git a/Misc/NEWS b/Misc/NEWS
index c9c9b55..571094c 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@
Core and Builtins
-----------------
+- Issue #2016: Fixed a crash in a corner case where the dictionary of keyword
+ arguments could be modified during the function call setup.
+
- Removed the ipaddr module.
- Issue #6329: Fixed iteration for memoryview objects (it was being blocked
diff --git a/Objects/funcobject.c b/Objects/funcobject.c
index 14484e5..7774e6d 100644
--- a/Objects/funcobject.c
+++ b/Objects/funcobject.c
@@ -489,13 +489,14 @@
{
PyObject *result;
PyObject *argdefs;
+ PyObject *kwtuple = NULL;
PyObject **d, **k;
Py_ssize_t nk, nd;
argdefs = PyFunction_GET_DEFAULTS(func);
if (argdefs != NULL && PyTuple_Check(argdefs)) {
d = &PyTuple_GET_ITEM((PyTupleObject *)argdefs, 0);
- nd = PyTuple_Size(argdefs);
+ nd = PyTuple_GET_SIZE(argdefs);
}
else {
d = NULL;
@@ -505,16 +506,17 @@
if (kw != NULL && PyDict_Check(kw)) {
Py_ssize_t pos, i;
nk = PyDict_Size(kw);
- k = PyMem_NEW(PyObject *, 2*nk);
- if (k == NULL) {
- PyErr_NoMemory();
+ kwtuple = PyTuple_New(2*nk);
+ if (kwtuple == NULL)
return NULL;
- }
+ k = &PyTuple_GET_ITEM(kwtuple, 0);
pos = i = 0;
- while (PyDict_Next(kw, &pos, &k[i], &k[i+1]))
+ while (PyDict_Next(kw, &pos, &k[i], &k[i+1])) {
+ Py_INCREF(k[i]);
+ Py_INCREF(k[i+1]);
i += 2;
+ }
nk = i/2;
- /* XXX This is broken if the caller deletes dict items! */
}
else {
k = NULL;
@@ -524,12 +526,11 @@
result = PyEval_EvalCodeEx(
(PyCodeObject *)PyFunction_GET_CODE(func),
PyFunction_GET_GLOBALS(func), (PyObject *)NULL,
- &PyTuple_GET_ITEM(arg, 0), PyTuple_Size(arg),
+ &PyTuple_GET_ITEM(arg, 0), PyTuple_GET_SIZE(arg),
k, nk, d, nd,
PyFunction_GET_CLOSURE(func));
- if (k != NULL)
- PyMem_DEL(k);
+ Py_XDECREF(kwtuple);
return result;
}